A vulnerability in the Linux kernel's netfilter nft_flow_offload component causes a reference leak on initialization error paths. Specifically, when nft_flow_offload_init() increments the flowtable use count but nf_ct_netns_get() fails, the reference is leaked because the error path does not properly undo the increment. This leak prevents the flowtable from being removed, causing NFT_MSG_DELFLOWTABLE to report busy errors even when no rules reference it.
A vulnerability in the Linux kernel's kprobes subsystem on x86 platforms involves improper handling of disarmed probes when checking for optimized kprobe overlaps. Specifically, when an optimized kprobe replaces five bytes with a jump instruction, a disabled probe located within this jump range can cause the kernel to incorrectly stop checking for active probes, leading to an incorrect jump address during execution. This flaw has been resolved by modifying the kernel to skip disarmed probes and continue searching for the active optimized probe before arming a new probe.
A vulnerability in the Linux kernel's dm-pcache component was resolved by bounding the logical key offset from persistent memory. The flaw involved the cache_key_decode() function using a logical offset that could index outside the bounds of an array, leading to an out-of-bounds write during replay. The fix rejects keys of zero length or keys whose offset plus length exceed the device size before use.
A vulnerability in the Linux kernel's scheduler extension was resolved by ensuring that the system waits for the SCX_OPSS_DISPATCHING state to clear before reenqueueing a task. Previously, a task could be requeued prematurely, causing the dispatcher's final state update to overwrite the queued state and drop subsequent dispatches of that task.
A vulnerability in the Linux kernel's pfcp subsystem was resolved involving improper socket lifetime management during netdevice registration failure. Specifically, a NULL pointer dereference could occur if the netdevice registration failed after socket creation, due to double release of the socket resource. This issue was identified through fault injection testing and results in a kernel NULL pointer dereference.
A vulnerability in the Linux kernel's rtc: ac100 driver was fixed by ensuring the .num member is assigned before accessing the .hws array. Without this fix, the bounds sanitizer (UBSAN_BOUNDS) can report out-of-bounds array access during probe, potentially causing traps with certain compiler and kernel configurations.
A vulnerability in the Linux kernel's handling of IPv6 tunneled packets was resolved by improving detection of IPv6 extension headers in tunneled traffic. The issue involved incorrect handling of outer and inner IPv6 headers in various tunneling scenarios, leading to false positives and unsafe header dereferencing. The fix ensures proper parsing of outer and inner IPv6 extension headers and safer header access methods.
A vulnerability in the Linux kernel's net/packet subsystem involving TX_RING byte count overflow has been resolved. The issue arises because tpacket_snd() accumulates packet lengths in a signed integer, which can overflow into the negative range after many transmissions. This causes sock_sendmsg_nosec() to misinterpret the value and trigger a kernel BUG, potentially leading to a kernel panic on systems configured to panic on oops. The flaw allows a CAP_NET_RAW user to cause a host kernel panic. The fix prevents the byte count from exceeding INT_MAX by stopping before the overflow occurs.
A vulnerability in the Linux kernel's HID multitouch driver was resolved by changing the timer shutdown method to prevent use-after-free conditions. The issue involved the release timer being rearmed after it was deleted, leading to potential dereferencing of freed memory. The fix replaces timer_delete_sync() with timer_shutdown_sync() to ensure the timer cannot be rearmed after teardown.
A use-after-free vulnerability in the Linux kernel's io_uring implementation with SQPOLL mode has been resolved. The issue occurs because the sqpoll thread processes task_work independently, potentially freeing resources while another function still accesses them. This leads to a use-after-free condition detected by KASAN. The fix involves holding an RCU read lock during task_work addition and waiting for a grace period before freeing resources.
A vulnerability in the Linux kernel's of/overlay subsystem was resolved by ensuring that only strictly positive changeset IDs are treated as registered. The issue involved improper handling of negative IDs returned by idr_alloc() on failure, which led to a NULL pointer dereference during cleanup. This could cause a kernel crash due to dereferencing uninitialized memory.
A flaw in Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e affects the UserDao.login function in AdminDao.java. This vulnerability involves manipulation of the Password argument causing cleartext storage of sensitive information. Exploitation requires local access. The issue was reported early to the project, but no response or fix has been issued yet. The vulnerability has a low CVSS score of 3.3 and no known active exploitation in the wild.
A vulnerability in the Linux kernel's netfs component was resolved that involved stale data being written back due to gaps left unread on the server side during streaming writes. The flaw caused stale folio content to be written back after a short or EOF response. The fix involves zeroing these gaps after the read completes to prevent stale data from being written back.
A vulnerability in the Linux kernel's virtual terminal (vt) subsystem caused an out-of-bounds memory access when updating the screen for invisible virtual consoles with certain font size changes. The issue arose because the framebuffer backing buffer was not resized for invisible consoles, but screen updates were still performed without the necessary visibility checks. This has been resolved by adding a visibility check before pushing screen updates.
A vulnerability in the Linux kernel related to the RTC spear driver was resolved by initializing the IRQ state before requesting the alarm IRQ. The issue was that devm_request_irq() enables the interrupt before returning, potentially causing the interrupt handler to run while the device probe was still initializing. The fix involved initializing the MMIO address and spinlock prior to requesting the alarm IRQ.
A vulnerability in the Linux kernel's blk-cgroup subsystem involves improper handling of interrupt states in the function blkg_tryget_closest(). This can lead to deadlocks due to interrupts being enabled while a spinlock is held, allowing nested lock acquisition in softirq context. The issue arises when bio_set_dev() is called with interrupts disabled, but blkg_tryget_closest() unconditionally enables interrupts, causing inconsistent lock usage and potential deadlock. The problem was introduced after changes to locking mechanisms and requires saving and restoring the caller's IRQ state to prevent this condition.
A double-free vulnerability in the Linux kernel's mtd core component related to the OTP NVMEM device has been resolved. The issue occurs if the factory OTP setup fails after the user OTP NVMEM device registration, leading to multiple unregister attempts without clearing the pointer. This flaw could cause kernel instability or crashes due to improper memory management.
A vulnerability in the Linux kernel TPM driver was resolved that previously allowed the TPM chip to continue serving requests despite a null key name integrity check failure. The null key name check is intended to protect against TPM reset attacks by disabling the chip on mismatch, but the chip remained enabled due to a logic flaw. This could lead to the use of uninitialized key handles in TPM commands. The fix changes the return code on mismatch to disable the chip and prevent further commands.
A vulnerability in the Linux kernel SCTP implementation was resolved that could lead to use-after-free conditions due to improper checking of socket shutdown state after a sendmsg connect wait. The issue involves sctp_wait_for_connect() dropping the socket lock while sleeping, allowing concurrent shutdowns to cause dangling pointer dereferences in sctp_sendmsg_to_asoc().
A use-after-free vulnerability was resolved in the Linux kernel ALSA caiaq driver. The issue occurs when the input device is registered during probe but not unregistered if subsequent initialization steps fail, leading to a dangling pointer and potential kernel memory corruption when accessing the device's uevent attribute.